Etowah Lane Equipment Rental / BB-Demo – Security Review
Callcompleted
Etowah Lane Equipment Rental · 2026-08-18 16:15
Ravi Subramanian questioned a reference customer on the EU outage. The reference was positive on disclosure and credit, but Ravi said it does not close a finding and gave no date. Six documents are owed.
What was said
What this says
Current to 13 Oct 26Ravi Subramanian questioned a reference customer on the EU outage. The reference was positive on disclosure and credit, but Ravi said it does not close a finding and gave no date. Six documents are owed.
What happened: Ravi Subramanian, the Chief Information Security Officer, put numbered questions to a reference customer, Oluwaseun Bamidele, about the EU cluster outage. Jordan Pike mostly listened and took notes.
Customer view: Oluwaseun praised the disclosure and said the Enterprise service credit arrived without a claim. Ravi said a reference does not close a finding and that he needs the control and the evidence.
Commercial: Ravi will not discuss commercial matters and gave no date. A closed finding needs documents he has read, so the security review stays open.
Watch: Six items are owed: the incident report, incident history, access model, follow-up on actions, recovery rehearsal evidence and the disclosure procedure. Jordan said he would send them together the same day.
Themes
Current to 9 Oct 26Theme
Security review, incident evidence
Importance
neutral
Sentiment
mixed
Voice
decision-maker
Who was there
BB-Demo
CRMmade from
Them
CRMmade from
Follow-up
Next steps
Current to 9 Oct 26- Jordan Pike to send the six documents to Ravi Subramanian on 18 Aug 2026, each with a note on what it does and does not cover.
- Jordan Pike to add the reference customer's three suggested questions to the written answers.
- Ravi may take up the reference customer's offer of an email follow-up once he has read the documents.
Risks
Current to 9 Oct 26- Ravi has open findings on incident history, standing access and disclosure, and will give no date until he has read the documents.
- Six documents are owed, and any gap in them keeps the security review open.
Opportunities
Current to 9 Oct 26- The reference customer said the Enterprise service credit was applied without a claim and that they would sign the same order form again.
Transcript
Jordan Pike NoneHi Ravi, hi Oluwaseun. Can you both hear me okay?
Oluwaseun Bamidele NoneYes, loud and clear. Hello both. Thanks for the invite, Jordan.
Ravi Subramanian NoneI can hear you. Good afternoon. Apologies in advance, I have the audit committee papers open on the other screen, so I may glance away from time to time.- Jordan Pike NoneNo problem at all. Quick agenda and a time check, since we have forty-five minutes. Ravi asked to hear from a customer who was on the EU cluster during the outage. Oluwaseun has kindly agreed to do that. I'll make the introductions, then I'll mostly stay quiet and take notes on anything Ravi wants evidenced afterwards. To be transparent, I'd rather he hears the unvarnished version from a peer than the polished version from me.
- Oluwaseun Bamidele NoneHappy to give it as it was. Though I should say up front that I can only speak to our experience. I'm not here to tell you what to decide.
- Ravi Subramanian NoneUnderstood, and that is precisely what I want. Before we start, a word on how I run these. I open with my open findings. There are three that touch this call. First, incident history. Second, who has standing access to the data. Third, how a vendor discloses a failure to its customers. Your account speaks mostly to the third. I should also be clear that a reference customer does not close a finding for me. I need the control and the evidence. Your testimony is context, not a substitute.
- Jordan Pike NoneUnderstood, and we wouldn't ask you to treat it as one. After this call I'll send the written incident report and the post-incident actions, so you have the documents and not only the conversation.
- Ravi Subramanian NoneGood. Oluwaseun, may I put my questions to you in order? I tend to number them.
- Oluwaseun Bamidele NonePlease do. I'm used to numbered questions, I ask them myself.
- Ravi Subramanian NoneQuestion one. How did you first learn that there was an incident? Did you detect it, or did BB-Demo tell you?
- Oluwaseun Bamidele NoneHonestly, a bit of both, and I think that's worth being clear about. One of my analysts noticed that the brain wasn't answering the way it normally does. She flagged it internally and, I think, within minutes there was a message from BB-Demo already in our inbox and on the status page. So we were not left wondering whether it was us or them. They had got there at about the same moment we had.
- Ravi Subramanian NoneWho sent the message? A named person, or a distribution address?
- Oluwaseun Bamidele NoneA named person first, from their support side, and then our customer success contact picked it up and rang me directly. I didn't have to chase. That was the part I'd flag. In previous vendor incidents I've had to chase.
- Ravi Subramanian NoneQuestion two. What did the initial disclosure contain? I am interested in whether it was substantive or merely reassuring.
- Oluwaseun Bamidele NoneThe first note was short, as you'd expect. It said what was affected, that it was the EU cluster, that they were working on it, and when they would update next. And then they did update at the time they said. That sounds trivial, but a lot of vendors say they'll update in an hour and then go silent for three.
- Ravi Subramanian NoneDid they at any point tell you something that later proved wrong?
- Oluwaseun Bamidele NoneMm. Not that I'd call wrong. There was one early estimate of when things would be back that slipped, and they said so plainly in the next update rather than letting it pass. I'd rather that than a vague line.
- Jordan Pike NoneCan I just jump in on that one? Ravi, that's a fair point to raise with us, and the incident report we send will show the estimate and the revision as they happened. I don't want you relying on Oluwaseun's memory for that.
- Ravi Subramanian NonePlease evidence that. Noted. Continue, Oluwaseun.
- Oluwaseun Bamidele NoneSure. So after it was resolved, we got a full written report. I'd say it was a proper document. Timeline, what failed, why it failed, what the blast radius was, and whether our data was touched. That last one was my first question, obviously, and it was answered directly. I'd also point out that because BB-Demo runs inside our own Snowflake account, I could check some of that myself rather than taking their word for it.
- Ravi Subramanian NoneWhich of it were you able to verify independently?
- Oluwaseun Bamidele NoneThe access side. We looked at our own query history and the roles in our account for the period, and nothing there contradicted the report. I wouldn't claim we verified every line of it. The root cause analysis I took on trust, with a fair amount of questioning. But the question that mattered to me, whether anything was exposed, we could test.
- Ravi Subramanian NoneThat is helpful, and it speaks to my second finding. Who has standing access to your Snowflake account on the BB-Demo side?
- Oluwaseun Bamidele NoneMy understanding is that it's role-based and scoped, and that we control the roles. I'd want my team to confirm the precise detail rather than quote it from memory, but it's not standing access in the sense of someone with a permanent key to everything. Jordan, you'll have the access model written down?
- Jordan Pike NoneYes, and here's where we are on that. Because the brain is built and run inside the customer's account, the customer owns the roles and grants. I'll send the access model document and the security review pack alongside the incident report. If there's anything in there that isn't clear or that you think is a gap, tell me and I'll say so plainly.
- Ravi Subramanian NoneI will read it with that in mind. Back to the incident. Question three. What is your own view of their incident history? Was this the first event you had seen, and do you have any visibility of earlier ones?
- Oluwaseun Bamidele NoneIt was the first one that affected us in a way we noticed. Beyond that I can't speak for the wider history, and I wouldn't want to pretend I can. What I can say is that when I asked them about previous incidents during the review, they didn't dodge. I'd suggest you ask for the list directly. Don't take my impression as the evidence.
- Ravi Subramanian NoneThat is the correct instinct. Jordan, I would like the incident history as a document. Please put it on the list.
- Jordan Pike NoneOn the list. Incident history, access model, the post-incident report. I'll confirm the three in writing today.
- Ravi Subramanian NoneQuestion four. Credit. I will not discuss commercial matters with you, so I am asking only about process. How was the service credit handled? Did you have to claim it?
- Oluwaseun Bamidele NoneNo, and that surprised me a little. It was in the contract, we're on Enterprise, which covers availability and data freshness. I had assumed I would need to raise a claim with a pile of evidence. Instead their team came back and said, here's what we've worked out, here's the credit, it'll appear on the next invoice. And it did.
- Ravi Subramanian NoneDid you agree with their calculation?
- Oluwaseun Bamidele NoneWe checked it against the order form and it matched the terms. There was no negotiation. I'd say that's another thing that tells you about a company, whether they make you argue for what's already written down.
- Ravi Subramanian NoneNoted. And yet I would observe that a credit is a financial remedy. It tells me nothing about the control. What did they change, Oluwaseun? That is question five, and for me it is the one that matters.
- Oluwaseun Bamidele NoneRight, and that's fair. So the report had a section of actions, and I remember three themes. One was detection: they changed how they monitor that part of the cluster so that they find out before a customer does. One was the recovery process: they rewrote and rehearsed the steps, because part of the delay was in how the steps were followed. And the third was communication, a tighter internal rule on when the customer is told and by whom.
- Ravi Subramanian NoneWere those actions verified, or merely stated?
- Oluwaseun Bamidele NoneThey gave us a follow-up some weeks later saying which were done and which were still in progress. I would be careful: I can tell you that they reported back unprompted, and that the items were closed off in a list. I did not audit the work itself. That would be for you.
- Ravi Subramanian NoneThat is a fair and honest answer. Thank you.
- Jordan Pike NoneAnd Ravi, for what it's worth, the follow-up Oluwaseun mentioned will be in the pack too. Closed items with dates, open items with an owner. If something's still open, you'll see it's still open.
- Ravi Subramanian NoneGood. Question six, Oluwaseun. If you were in my chair, what would you press them on?
- Oluwaseun Bamidele NoneHm. Good question. Three things, I think. First, ask for the rehearsal evidence on the recovery steps, not just the rewritten procedure. Second, ask how they decide what to tell customers, and how quickly, because that's the bit that made the difference for us. Third, ask how the EU cluster is separated from everything else, because that's where the impact was contained and I'd want to know why.
- Ravi Subramanian NoneI will take those three. Jordan, you heard them.
- Jordan Pike NoneI did, and I'll add them to the questions I'm sending over, so the answers come back in one place. Nothing on that list is a problem for me to answer. If one of them is uncomfortable, I'd still rather you saw it.
- Ravi Subramanian NoneQuestion seven, and my last for you. Would you sign the same order form again, knowing what you know now? You may decline to answer.
- Oluwaseun Bamidele NoneI'm happy to answer. Yes, I would, but not because nothing went wrong. Something did go wrong. It's because of how they behaved when it did. I'd still be asking them the hard questions, and I'd expect you to. That's the job.
- Ravi Subramanian NoneThank you. That is more useful to me than reassurance. I have no further questions for Oluwaseun. Jordan, I will list what I now expect, and please correct me. One: the written incident report for the EU event. Two: the incident history. Three: the access model, showing who holds standing access. Four: the follow-up on closed and open actions. Five: evidence of the recovery rehearsal. Six: the disclosure procedure and how the EU cluster is isolated.
- Jordan Pike NoneThat's all six, and I've got them written down. I'll send the lot together, with a note against each one saying what it is and what it doesn't cover. And what would make this a yes for you on the review? Not asking for a commitment, just so I know what you need.
- Ravi Subramanian NoneA yes is a closed finding, and a closed finding requires evidence I have read. I will not give you a date for that until I have the documents. Please do not interpret my courtesy on this call as progress.
- Jordan Pike NoneFair enough, and I'd rather you said it that way. I'll get the documents to you quickly so the clock is yours, not ours.
- Oluwaseun Bamidele NoneRavi, if it's useful, I'm happy to take a follow-up question by email once you've read the pack. I'd just say that I can only talk to what we saw.
- Ravi Subramanian NoneUnderstood, and thank you. I may take you up on it. Good afternoon to you both.
- Jordan Pike NoneThanks, both. Oluwaseun, really appreciate you doing this. Ravi, you'll have the pack from me today. Thanks, Jordan.
Callsmade from